Comparison
HIPAA vs DORA
HIPAA Security Rule · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of HIPAA Security Rule and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 17 map to something in HIPAA, 4 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to HIPAA (1)
| DORA | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to HIPAA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (4)
| DORA | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.14 | Communication | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+3 | Only shares CSF RS.CO-03: related, not a mapping | |
| Chapter V: ICT third-party risk · 2 | ||||
| Art.28 | General principles | §164.308(b)(4)§164.314(a)§164.314(a)(2)(i)+5 | Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping | |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | §164.308(b)(4)§164.314(a)§164.314(a)(2)(i)+5 | Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping | |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a) | Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping | |
Mapped (17)
| DORA | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 9 | ||||
| Art.5 | Governance and organisation | Editorial | §164.308(a)(1)(ii)(B)§164.316(b)(2)(iii)§164.308(a)(2)+1 | Same topic: Risk Management, Governance Policy, Roles & Responsibilities (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | §164.308(a)(1)(ii)(B)§164.310(a)§164.310(a)(2)(ii)+5 | Same topic: Risk Management, Physical Security (editorial pick) |
| Art.8 | Identification | Editorial | §164.310(d)§164.310(d)(2)(iii)§164.308(a)(8) | Same topic: Asset Management, Vulnerability Mgmt (editorial pick) |
| Art.9 | Protection and prevention | Editorial | §164.308(a)(1)(ii)(D)§164.310(d)(2)(i)§164.316(a)+3 | Same topic: Cont. Monitoring, Data Protection, Governance Policy (editorial pick) |
| Art.10 | Detection | Editorial | §164.308(a)(1)(ii)(C) | Same topic: Insider Threat (editorial pick) |
| Art.11 | Response and recovery | Editorial | §164.308(a)(7)(ii)(C) | Same topic: Business Continuity (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Same topic: Backup & Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Same topic: Awareness & Training (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | §164.308(a)(1)(ii)(B) | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response, Reporting (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | §164.308(a)(6)(ii) | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | §164.308(a)(1)(ii)(B) | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 1 | ||||
| Art.30 | Key contractual provisions | Editorial | §164.308(b)(1)§164.314(a) | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) |
Of 69 HIPAA Security Rule requirements, 37 map to something in DORA, 30 are only loosely related, and 2 have no mapping in our data.
Covers the HIPAA Security Rule only (not the Privacy or Breach Notification Rules).
Likely new work: HIPAA requirements with no mapping to DORA (2)
| HIPAA | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| §164.310 Physical safeguards · 1 | ||||
| §164.310(d)(2)(ii) | Required Media Re-use | No mapping in our data | — | No mapping to DORA in our data. |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | No mapping in our data | — | No mapping to DORA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (30)
| HIPAA | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 12 | ||||
| §164.308(a)(1) | Security Management Process | Art.5(2)(b)Art.6(5)Art.9(4)(a)+5 | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(3) | Workforce Security | Art.5(2)(b)Art.6(5)Art.9(1)+5 | Only shares CSF GV.PO-01, GV.PO-02, DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | Art.10(3)Art.9(1)Art.5(2)(b)+5 | Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, GV.RR-04…: related, not a mapping | |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a)+5 | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | Art.9(2)Art.9(3)(c)Art.9(3)(d)+4 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | Art.10(3)Art.9(1)Art.5(2)(b)+5 | Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, GV.RR-04…: related, not a mapping | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | Art.5(2)(b)Art.6(5)Art.9(1)+5 | Only shares CSF GV.PO-01, GV.PO-02, DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | Art.5(4)Art.13(6)Art.9(1)+2 | Only shares CSF PR.AT-01, PR.AT-02, DE.CM-09: related, not a mapping | |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | Art.5(4)Art.10(2)Art.10(3)+2 | Only shares CSF PR.AT-01, PR.AT-02, DE.AE-02, DE.AE-03…: related, not a mapping | |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | Art.5(4)Art.13(6) | Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping | |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | Art.8(1)Art.8(2)Art.8(3)+5 | Only shares CSF GV.OC-04, ID.AM-05, ID.RA-04, ID.RA-05: related, not a mapping | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | Art.28(8)Art.30(2)Art.8(1)+5 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping | |
| §164.310 Physical safeguards · 2 | ||||
| §164.310(a)(2)(i) | Addressable Contingency Operations | Art.6(2)Art.9(4)(c)Art.12(1)+5 | Only shares CSF DE.CM-02, PR.AA-06, PR.IR-02, PR.DS-11…: related, not a mapping | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | Art.5(2)(b)Art.6(5)Art.9(4)(a)+5 | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.312 Technical safeguards · 5 | ||||
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | Art.9(4)(c)Art.9(1)Art.10(3)+5 | Only shares CSF PR.AA-01, PR.AA-05, PR.IR-02, DE.CM-01…: related, not a mapping | |
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | Art.9(4)(d) | Only shares CSF PR.AA-03: related, not a mapping | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| §164.312(e)(1) | Transmission Security | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| §164.314 Organizational requirements · 8 | ||||
| §164.314(a)(2)(i) | Required Business Associate Contracts | Art.18(1)Art.28(8)Art.30(2)+5 | Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping | |
| §164.314(a)(2)(ii) | Required Other Arrangements | Art.28(8)Art.30(2)Art.28(3)+5 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | Art.18(1)Art.28(8)Art.30(2)+5 | Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping | |
| §164.314(b) | Requirements for Group Health Plans | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | Art.28(8)Art.30(2)Art.28(3)+5 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping | |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | Art.18(1)Art.11(2)(b)Art.17(1)+5 | Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping | |
| §164.316 Policies and documentation · 3 | ||||
| §164.316(b) | Documentation | Art.8(1)Art.8(2)Art.8(4)+5 | Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping | |
| §164.316(b)(2)(i) | Required Time Limit | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| §164.316(b)(2)(ii) | Required Availability | Art.5(2)(b)Art.6(5)Art.9(4)(a)+5 | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
Mapped (37)
| HIPAA | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 18 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Editorial | Art.8(2)Art.8(3)Art.8(7)+3 | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+6 | Same topic: Risk Management (editorial pick) |
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | Editorial | Art.9(1)Art.10(2)Art.10(3) | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| §164.308(a)(2) | Assigned Security Responsibility | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| §164.308(a)(4) | Information Access Management | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| §164.308(a)(5) | Security Awareness and Training | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| §164.308(a)(6) | Security Incident Procedures | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| §164.308(a)(6)(ii) | Required Response and Reporting | Editorial | Art.11(2)(b)Art.11(2)(c)Art.17(1)+6 | Same topic: Incident Response, Mitigation (editorial pick) |
| §164.308(a)(7) | Contingency Plan | Editorial | Art.11(3)Art.12(6) | Same topic: Recovery Planning (editorial pick) |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | Editorial | Art.11(3)Art.11(6)Art.12(4)+1 | Same topic: Recovery Planning, Disaster Recovery (editorial pick) |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | Editorial | Art.11(1)Art.11(4)Art.11(6) | Same topic: Business Continuity (editorial pick) |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | Editorial | Art.11(6)Art.12(4) | Same topic: Disaster Recovery (editorial pick) |
| §164.308(a)(8) | Evaluation | Editorial | Art.5(2)(f)Art.6(6)Art.6(7)+4 | Same topic: Compliance (editorial pick) |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| §164.310 Physical safeguards · 9 | ||||
| §164.310(a) | Facility Access Controls | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| §164.310(b) | Workstation Use | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| §164.310(c) | Workstation Security | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| §164.310(d) | Device and Media Controls | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| §164.310(d)(2)(i) | Required Disposal | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| §164.310(d)(2)(iii) | Addressable Accountability | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| §164.312 Technical safeguards · 7 | ||||
| §164.312(a) | Access Control | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| §164.312(a)(2)(i) | Required Unique User Identification | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| §164.312(b) | Audit Controls | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| §164.312(c) | Integrity | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| §164.312(d) | Person or Entity Authentication | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| §164.312(e)(2)(ii) | Addressable Encryption | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| §164.316 Policies and documentation · 2 | ||||
| §164.316(a) | Policies and Procedures | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| §164.316(b)(2)(iii) | Required Updates | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
By topic
Both cover (25):
Governance PolicyAwareness & TrainingRisk ManagementRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentVulnerability MgmtAccess ControlEncryptionData ProtectionBackup & RecoveryCloud SecurityCont. MonitoringLogging & AuditSIEM / SOCIncident ResponseMitigationReportingRecovery PlanningBusiness ContinuityDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only HIPAA (2):
Only DORA (14):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.